Heap-based Buffer Overflow in the psf_binheader_writef function in common.c in libsndfile through 1.0.28 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libsndfile: Heap overflow vulnerability when parsing specially crafted AIFF header (CVE-2015-7805)

  - libsndfile: Heap-based Buffer Overflow in psf_binheader_writef function in common.c (CVE-2017-12562)

  - The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via     vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read.
    (CVE-2014-9496)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libsndfile: Heap overflow vulnerability when parsing specially crafted AIFF header (CVE-2015-7805)

  - libsndfile: Heap-based Buffer Overflow in psf_binheader_writef function in common.c (CVE-2017-12562)

  - The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via     vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read.
    (CVE-2014-9496)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3058 advisory.

  - Heap-based Buffer Overflow in the psf_binheader_writef function in common.c in libsndfile through 1.0.28     allows remote attackers to cause a denial of service (application crash) or possibly have unspecified     other impact. (CVE-2017-12562)

  - An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to     submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with     libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a     crash but could potentially leak memory information that could be used in further exploitation of other     flaws. (CVE-2021-4156)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4704-1 advisory.

    It was discovered that libsndfile incorrectly handled certain malformed files. A remote attacker could use     this issue to cause libsndfile to crash, resulting in a denial of service, or possibly execute arbitrary     code. (CVE-2017-12562)

    It was discovered that libsndfile incorrectly handled certain malformed files. A remote attacker could use     this issue to cause libsndfile to crash, resulting in a denial of service, or possibly execute arbitrary     code. This issue only affected Ubuntu 14.04 ESM. (CVE-2017-14245, CVE-2017-14246, CVE-2017-14634,     CVE-2017-16942, CVE-2017-6892, CVE-2018-13139, CVE-2018-19432, CVE-2018-19661, CVE-2018-19662,     CVE-2018-19758, CVE-2019-3832)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libsndfile package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The psf_fwrite function in file_io.c in libsndfile     allows attackers to cause a denial of service     (divide-by-zero error and application crash) via     unspecified vectors related to the headindex     variable.(CVE-2014-9756)

  - Heap-based Buffer Overflow in the psf_binheader_writef     function in common.c in libsndfile through 1.0.28     allows remote attackers to cause a denial of service     (application crash) or possibly have unspecified other     impact.(CVE-2017-12562)

  - In libsndfile 1.0.28, a divide-by-zero error exists in     the function double64_init() in double64.c, which may     lead to DoS when playing a crafted audio     file.(CVE-2017-14634)

  - In libsndfile 1.0.25 (fixed in 1.0.26), a     divide-by-zero error exists in the function     wav_w64_read_fmt_chunk() in wav_w64.c, which may lead     to DoS when playing a crafted audio     file.(CVE-2017-16942)

  - In libsndfile before 1.0.28, an error in the     'flac_buffer_copy()' function (flac.c) can be exploited     to cause a stack-based buffer overflow via a specially     crafted FLAC file.(CVE-2017-7585)

  - In libsndfile before 1.0.28, an error in the     'header_read()' function (common.c) when handling ID3     tags can be exploited to cause a stack-based buffer     overflow via a specially crafted FLAC     file.(CVE-2017-7586)

  - In libsndfile before 1.0.28, an error in the     'flac_buffer_copy()' function (flac.c) can be exploited     to cause a segmentation violation (with write memory     access) via a specially crafted FLAC file during a     resample attempt, a similar issue to     CVE-2017-7585.(CVE-2017-7741)

  - In libsndfile before 1.0.28, an error in the     'flac_buffer_copy()' function (flac.c) can be exploited     to cause a segmentation violation (with read memory     access) via a specially crafted FLAC file during a     resample attempt, a similar issue to     CVE-2017-7585.(CVE-2017-7742)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libsndfile package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In libsndfile before 1.0.28, an error in the     'header_read()' function (common.c) when handling ID3     tags can be exploited to cause a stack-based buffer     overflow via a specially crafted FLAC     file.(CVE-2017-7586)

  - Heap-based Buffer Overflow in the psf_binheader_writef     function in common.c in libsndfile through 1.0.28     allows remote attackers to cause a denial of service     (application crash) or possibly have unspecified other     impact.(CVE-2017-12562)

  - In libsndfile 1.0.25 (fixed in 1.0.26), a     divide-by-zero error exists in the function     wav_w64_read_fmt_chunk() in wav_w64.c, which may lead     to DoS when playing a crafted audio     file.(CVE-2017-16942)

  - In libsndfile 1.0.28, a divide-by-zero error exists in     the function double64_init() in double64.c, which may     lead to DoS when playing a crafted audio     file.(CVE-2017-14634)

  - The psf_fwrite function in file_io.c in libsndfile     allows attackers to cause a denial of service     (divide-by-zero error and application crash) via     unspecified vectors related to the headindex     variable.(CVE-2014-9756)

  - In libsndfile before 1.0.28, an error in the     'flac_buffer_copy()' function (flac.c) can be exploited     to cause a segmentation violation (with write memory     access) via a specially crafted FLAC file during a     resample attempt, a similar issue to     CVE-2017-7585.(CVE-2017-7741)

  - In libsndfile before 1.0.28, an error in the     'flac_buffer_copy()' function (flac.c) can be exploited     to cause a segmentation violation (with read memory     access) via a specially crafted FLAC file during a     resample attempt, a similar issue to     CVE-2017-7585.(CVE-2017-7742)

  - In libsndfile version 1.0.28, an error in the     'aiff_read_chanmap()' function (aiff.c) can be     exploited to cause an out-of-bounds read memory access     via a specially crafted AIFF file.(CVE-2017-6892)

  - The flac_buffer_copy function in flac.c in libsndfile     1.0.28 allows remote attackers to cause a denial of     service (buffer overflow and application crash) or     possibly have unspecified other impact via a crafted     audio file.(CVE-2017-8361)

  - The flac_buffer_copy function in flac.c in libsndfile     1.0.28 allows remote attackers to cause a denial of     service (invalid read and application crash) via a     crafted audio file.(CVE-2017-8362)

  - The flac_buffer_copy function in flac.c in libsndfile     1.0.28 allows remote attackers to cause a denial of     service (heap-based buffer over-read and application     crash) via a crafted audio file.(CVE-2017-8363)

  - The i2les_array function in pcm.c in libsndfile 1.0.28     allows remote attackers to cause a denial of service     (buffer over-read and application crash) via a crafted     audio file.(CVE-2017-8365)

  - The sd2_parse_rsrc_fork function in sd2.c in libsndfile     allows attackers to have unspecified impact via vectors     related to a (1) map offset or (2) rsrc marker, which     triggers an out-of-bounds read.(CVE-2014-9496)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libsndfile package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Heap-based Buffer Overflow in the psf_binheader_writef     function in common.c in libsndfile through 1.0.28     allows remote attackers to cause a denial of service     (application crash) or possibly have unspecified other     impact.(CVE-2017-12562)

  - It was discovered the fix for CVE-2018-19758     (libsndfile) was not complete and still allows a read     beyond the limits of a buffer in wav_write_header()     function in wav.c. A local attacker may use this flaw     to make the application crash.(CVE-2019-3832)

  - An issue was discovered in libsndfile 1.0.28. There is     a buffer over-read in the function i2alaw_array in     alaw.c that will lead to a denial of     service.(CVE-2018-19662)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201811-23 (libsndfile: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libsndfile. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by enticing a user to open a specially crafted file,       could cause a Denial of Service condition or have other unspecified       impacts.
  Workaround :

    There is no known workaround at this time.

Agostino Sarubbo, Gentoo reports :

CVE-2017-8361 (Medium): The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file.

CVE-2017-8362 (Medium): The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted audio file.

CVE-2017-8363 (Medium): The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.

CVE-2017-8365 (Medium): The i2les_array function in pcm.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file.

manxorist on Github reports :

CVE-2017-12562 (High): Heap-based Buffer Overflow in the psf_binheader_writef function in common.c in libsndfile through 1.0.28 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.

Xin-Jiang on Github reports :

CVE-2017-14634 (Medium): In libsndfile 1.0.28, a divide-by-zero error exists in the function double64_init() in double64.c, which may lead to DoS when playing a crafted audio file.

fixes heap-based Buffer Overflow in psf_binheader_writef function (#1483140, CVE-2017-12562)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was a heap buffer overflow attack in libsndfile, a library for reading/writing audio files. An attacker could cause a remote denial of service attack by tricking the function into outputting a large amount of data.

For Debian 7 'Wheezy', this issue has been fixed in libsndfile version 1.0.25-9.1+deb7u4.

We recommend that you upgrade your libsndfile packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198640	RHEL 6 : libsndfile (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198587	RHEL 7 : libsndfile (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196344	RHEL 7 : libsndfile (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196321	RHEL 6 : libsndfile (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
162596	Debian DLA-3058-1 : libsndfile - LTS security update	Nessus	Debian Local Security Checks	critical
145464	Ubuntu 16.04 LTS : libsndfile vulnerabilities (USN-4704-1)	Nessus	Ubuntu Local Security Checks	critical
132151	EulerOS 2.0 SP3 : libsndfile (EulerOS-SA-2019-2616)	Nessus	Huawei Local Security Checks	critical
131666	EulerOS 2.0 SP2 : libsndfile (EulerOS-SA-2019-2513)	Nessus	Huawei Local Security Checks	critical
131516	EulerOS Virtualization for ARM 64 3.0.3.0 : libsndfile (EulerOS-SA-2019-2351)	Nessus	Huawei Local Security Checks	critical
119318	GLSA-201811-23 : libsndfile: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
107109	FreeBSD : libsndfile -- multiple vulnerabilities (2b386075-1d9c-11e8-b6aa-4ccc6adda413)	Nessus	FreeBSD Local Security Checks	critical
102903	Fedora 25 : libsndfile (2017-fa6784d0bd)	Nessus	Fedora Local Security Checks	critical
102794	Fedora 26 : libsndfile (2017-67a3755b96)	Nessus	Fedora Local Security Checks	critical
102220	Debian DLA-1049-1 : libsndfile security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2017-12562

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical